diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index de70371bf..90fba585c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -139,9 +139,11 @@ jobs:
     - name: Run Coverage Tests
       run: sudo -E make -C scripts/ci local GCOV=1
     - name: Run gcov
-      run: sudo -E find . -name '*gcda' -type f -print0 | sudo -E xargs --null --max-args 128 --max-procs 4 gcov
-    - name: Run Coverage Analysis
-      run: sudo -E make codecov
+      run: sudo -E find . -name '*gcda' -type f -print0 | sudo -E xargs --null --max-args 128 gcov
+    - name: Upload coverage to Codecov
+      uses: codecov/codecov-action@v5
+      with:
+        token: ${{ secrets.CODECOV_TOKEN }}
 
   java-test:
     needs: [alpine-test]
diff --git a/scripts/ci/run-ci-tests.sh b/scripts/ci/run-ci-tests.sh
index 05a3b71e8..89a3f3384 100755
--- a/scripts/ci/run-ci-tests.sh
+++ b/scripts/ci/run-ci-tests.sh
@@ -195,6 +195,9 @@ fi
 # umask has to be called before a first criu run, so that .gcda (coverage data)
 # files are created with read-write permissions for all.
 umask 0000
+# Also fix permissions on .gcda files already created during the build (owned
+# by root). Restored processes run as non-root and must be able to write them.
+find . -name '*.gcda' -exec chmod a+rw {} +
 ./criu/criu check
 ./criu/criu check --all || echo $?
 if [ "$UNAME_M" == "x86_64" ]; then